{"id":"EUVD-2026-103176","revision":"5173b4c9dc4c4804b490470809f3caeb","records":[{"revision":"5173b4c9dc4c4804b490470809f3caeb","observedAt":"2026-10-28T10:38:04.327+00:00","statement":{"source":"euvd","id":"EUVD-2026-103176","aliases":["CVE-2026-96628","GHSA-mp22-58ff-6fhr"],"title":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired …","description":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin. This exposes administrator-restricted Go pprof runtime and diagnostic information and may impose profiling overhead. This issue is fixed in version 2.11.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/getarcaneapp/arcane/security/advisories/GHSA-mp22-58ff-6fhr","https://github.com/getarcaneapp/arcane/pull/3881","https://github.com/getarcaneapp/arcane/commit/4fe4c7ed9483dff7d43e3c4bee6a92037ce886b4","https://github.com/getarcaneapp/arcane/releases/tag/backend/v2.11.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103176","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 16, 2026, 9:10:29 PM","dateUpdated":"Oct 19, 2026, 4:40:50 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-103176","identifiers":["EUVD-2026-103176","CVE-2026-96628","GHSA-mp22-58ff-6fhr"]},"retained":false,"historicalAffected":[]}],"coverage":[]}